Skip to main content
GET
Retrieve audit events (v3 beta)
Retrieve event data from your 1Password account to determine who performed an action and when, like when a team member edits an item’s password or invites another team member to a shared vault. Use the start_time and end_time parameters to filter events by the time they were ingested by 1Password (insert_time), not the time they occurred (create_time). To continue polling for new events, start a new request using the insert_time of the last event as the value for start_time. Learn more about continuous polling in the beta API. Use max_page_size to set the number of events returned per page (100 by default, up to 1000). If more results are available, the response includes a next_page_token at the top level. Pass it in the page_token query parameter to fetch the next page.
Don’t use the start_time or end_time query parameters in a request that also uses the page_token query parameter. Doing so will result in a 400 bad request error.
If the response is successful but there aren’t any events for the parameters you requested, the audit_events array is empty ([]). This endpoint is rate limited. Requests that exceed the limit return a 429 Too Many Requests error and include a Retry-After header. Learn more about rate limits. See the API conventions for more information about authentication, pagination, filtering, and error handling.

Authorizations

Authorization
string
header
required

Bearer authentication using a JWT issued for a service account. Use the bearer token from your Events Reporting integration, scoped to access audit events.

Query Parameters

max_page_size
integer
default:100

The maximum number of events to return per page, from 0 to 1000. If you omit this parameter or set it to 0, the server default of 100 is used. The endpoint accepts any positive value, but returns no more than 1000 events per page.

Required range: 0 <= x <= 1000
page_token
string

An opaque cursor token that identifies the next page of results to retrieve. Use the next_page_token value from the previous response. Don't use the start_time or end_time parameters with page_token: doing so returns a 400 bad request error.

start_time
string<date-time>

The lower bound insertion time for which to retrieve results, filtering on when events were ingested, not when they occurred. This bound is exclusive: only events whose insertion time is strictly greater than start_time are returned. Invalid if page_token is specified. Uses the RFC 3339 standard.

end_time
string<date-time>

The upper bound insertion time for which to retrieve results, filtering on when events were ingested, not when they occurred. This bound is exclusive: only events whose insertion time is strictly less than end_time are returned. Invalid if page_token is specified. Uses the RFC 3339 standard.

Response

A subset of the audit events that match the request, with a token to fetch the next page of results if more are available. If no events match, the audit_events array is empty.

audit_events
object[]
required

A subset of the requested audit events. An empty array ([]) indicates that no events match the request.

next_page_token
string

An opaque token used to retrieve the next page of results. Pass it as the page_token query parameter on the next request. Present only when additional results are available; if it's absent, there are no more pages.

Example:

"CAESCwiY84XSBhC0qu9uGgYIgO600wYg_qXh7fMzKhpXNFRTRVA3UDVSSFBCQUpKM1JDWkdYTFpESQ"